News for hackers. Stuff that matters.
Re:Reporter who told Missouri officials of website flaw did ... by alexjplant on Wednesday November 03, 2021 @03:21PM (#29099124)
The DoE is complicit in this as well (from the original article):

> In the letter to teachers, Education Commissioner Margie Vandeven said “an individual took the records of at least three educators, unencrypted the source code from the webpage, and viewed the social security number (SSN) of those specific educators.”

> But in the press release, DESE called the person who discovered the vulnerability a “hacker” and said that individual “took the records of at least three educators”

This squares perfectly with my own experience. As a middle schooler I had several interactions with my school system's IT department where they baselessly accused me of hacking and malicious intent; I responsibly disclosed a method of bypassing their web content filter and they responded by going through my roaming profile and leveling charges at me of "remotely hacking computer systems" because of a screenshot of a terminal emulator they found. I was a good kid with a perfect disciplinary record. In retrospect it was a series of incompetent staffers covering for their inability by bullying a child.

The US needs to stop using public facilities (schools, the military, etc) as white-collar welfare and hire more people that actually care. Ignorance is forgivable but when combined with a steadfast opposition to personal growth it becomes malicious. It'd be better for society to fire clowns like these and administer them unemployment than to have them crowd out those that actually give a shit.

*EDIT: To clarify for anybody that would read the above as "government workers don't care": there are plenty that do. I break bread with them and want them to be able to do their jobs unimpeded by the ones that _don't_.

Re:Reporter who told Missouri officials of website flaw did ... by handrous on Wednesday November 03, 2021 @04:35PM (#29099925)
> The US needs to stop using public facilities (schools, the military, etc) as white-collar welfare and hire more people that actually care. Ignorance is forgivable but when combined with a steadfast opposition to personal growth it becomes malicious. It'd be better for society to fire clowns like these and administer them unemployment than to have them crowd out those that actually give a shit.

Our purest white-collar welfare system is the health insurance industry, I'd say. IIRC at one point Obama explicitly stated that a reason he didn't think single-payer and similar were viable to advance, is because they'd put too many people out of work.

The military is, obviously, our main work-required blue-collar welfare system, among other kinds of wealth-shuffling it does. Why, one can get nearly-European-standard-for-all public benefits, through that program, provided one is reasonably sound of body and mind. Healthcare, pension, housing, et c. [edit] education, too!

Re:Reporter who told Missouri officials of website flaw did ... by justin_oaks on Wednesday November 03, 2021 @06:37PM (#29101366)
I do remember Obama talking about losing jobs in health care. With that kind of logic, we'd never have allowed cars because the horse and carriage industries would lose jobs.

I'm not unsympathetic to those who would lose jobs from changes in the industry. Here's my thought: if government action that disrupts an industry then that action should be done piecemeal over several years to allow a softer transition.

Re:Reporter who told Missouri officials of website flaw did ... by jayd16 on Thursday November 04, 2021 @12:36AM (#29103709)
Its not just a matter of sympathy. Government still needs support from the populous even when the populous is short sighted. Its a practical calculation to say good but unpopular policy will ultimately fail.
Re:Reporter who told Missouri officials of website flaw did ... by megablast on Wednesday November 03, 2021 @10:32PM (#29103079)
> With that kind of logic, we'd never have allowed cars because the horse and carriage industries would lose jobs.

Imagine not having 40,000 deaths a year, and many more seriously injured.

Re:Reporter who told Missouri officials of website flaw did ... by Dylan16807 on Wednesday November 03, 2021 @11:39PM (#29103475)
Did we invent crash-proof carriages when I wasn't looking?

> Reviewing British fatality rates from previous centuries, demographer P. E. H. Hair concluded in 1971 that the “supercession of the horse by the internal combustion engine was by no means the disaster in terms of travel safety it is often supposed to have been,” and suggested that between 1840 and 1900, accidents involving horses produced an average yearly mortality rate of about five per 100,000 population

> fatality rates from horse-powered transportation occurred at a rate more than 15 times greater per mile in 1775 than from motor vehicles in 2000 (even using very conservative estimates for per-mile horse-related fatalities)

> In New York in 1900, 200 persons were killed by horses and horse-drawn vehicles. This contrasts with 344 auto-related fatalities in New York in 2003; given the modern city’s greater population, this means the fatality rate per capita in the horse era was roughly 75 percent higher than today. Data from Chicago show that in 1916 there were 16.9 horse-related fatalities for each 10,000 horse-drawn vehicles; this is nearly seven times the city’s fatality rate per auto in 1997.

Re:Reporter who told Missouri officials of website flaw did ... by lmm on Thursday November 04, 2021 @01:02AM (#29103783)
> Did we invent crash-proof carriages when I wasn't looking?

Only if you've been not looking through e.g. the entire history of the NHTSA. Comparing horseless carriages under modern safety regulations to horse-drawn carriages not subject to those is a huge confounder. (And 1997-2000 sounds like a cherry-picked period; motor vehicles have been redesigned to kill significantly more pedestrians since then).

Re:Reporter who told Missouri officials of website flaw did ... by Dylan16807 on Thursday November 04, 2021 @01:23AM (#29103857)
> Only if you've been not looking through e.g. the entire history of the NHTSA. Comparing horseless carriages under modern safety regulations to horse-drawn carriages not subject to those is a huge confounder.

Modifiers like that don't really matter because the comment was acting like the alternative was zero deaths.

And modern safety regulations can only have so much influence on pedestrians especially.

> (And 1997-2000 sounds like a cherry-picked period; motor vehicles have been redesigned to kill significantly more pedestrians since then).

Well I'll assume if we were using carriages en masse they'd also be going through design changes to kill more people since that seems simplest and still supports my point that there would be many deaths.

Re:Reporter who told Missouri officials of website flaw did ... by lmm on Thursday November 04, 2021 @02:39AM (#29104113)
> Modifiers like that don't really matter because the comment was acting like the alternative was zero deaths.

Not necessarily, they could just mean many fewer deaths.

> Well I'll assume if we were using carriages en masse they'd also be going through design changes to kill more people since that seems simplest

It's not simple, there's a lot of complexity and path dependence to how we've ended up with these car designs and there's no reason to believe it would happen in the same way and the same order for carriages. But regardless, you have to average over such variations rather than picking one unrepresentative point.

> and still supports my point that there would be many deaths.

No it doesn't; you're cherry-picking the years when motor traffic was least deadly and comparing to a random time (or perhaps even the most deadly time?) for horse traffic.

Re:Reporter who told Missouri officials of website flaw did ... by Dylan16807 on Thursday November 04, 2021 @03:01AM (#29104213)
> Not necessarily, they could just mean many fewer deaths.

Maybe but "Imagine not having" sure sounds like you remove the deaths entirely.

> you're cherry-picking the years

That's a quote of an article that only compares those years. I'll thank you not to accuse me of cherry-picking here.

> It's not simple, there's a lot of complexity and path dependence to how we've ended up with these car designs and there's no reason to believe it would happen in the same way and the same order for carriages. But regardless, you have to average over such variations rather than picking one unrepresentative point.

You wanted to consider "modern safety regulations" as a confounding factor.

I see three options here.

1. Let's assume carriages would have undergone the same evolution of safety. That means modern carriages would have a lower death rate than old ones. It also makes the possible cherry-picking matter a lot less because the increasing menace of transportation over the last 20 years would be the same either way.

2. We say it's too complex and ignore those factors.

3. We invent an entire alternate history in excruciating detail.

Option 2 is bad, of course. I think option 1 is fine. If you want option 3, you're on your own.

Re:Reporter who told Missouri officials of website flaw did ... by lmm on Thursday November 04, 2021 @05:28AM (#29104999)
> 1. Let's assume carriages would have undergone the same evolution of safety. That means modern carriages would have a lower death rate than old ones. It also makes the possible cherry-picking matter a lot less because the increasing menace of transportation over the last 20 years would be the same either way.

That's like saying it's fine to compare the cost of houses in New York and San Francisco by comparing the cost of a house in New York in 1998 to the cost of a house in San Francisco in 2009, because house prices change at more or less the same rate everywhere in the country. It's true that house prices tend to go up or down at a similar rate everywhere, but it's still a problem if you cherry-pick the two years you're making a comparison with!

Re:Reporter who told Missouri officials of website flaw did ... by Talanes on Thursday November 04, 2021 @05:59AM (#29105202)
The person you keep replying to has not cherry-picked anything. They have merely selected the most conveniently available data source to quote.

https://www.accessmagazine.org/spring-2007/horse-power-horse...

You can criticize their choice of sources, you can dig deeper and provide more comprehensive data, but going post after post admonishing them for cherry-picking data that is just gauche. They didn't pick the years!

Re:Reporter who told Missouri officials of website flaw did ... by lmm on Thursday November 04, 2021 @09:55PM (#29114628)
They picked the sources, and their sources use apparently arbitrary dates that are particularly unrepresentative. Maybe that's just an unfortunate coincidence, but even if so, the net effect is the same as cherry-picking.
Re:Reporter who told Missouri officials of website flaw did ... by Talanes on Friday November 05, 2021 @08:31PM (#29126247)
Well, no it's not. Because if they were cherry-picking, then your needling them repeatedly over the data could actually produce a reaction that gets you more accurate data.

But since they are just presenting you with the most commonly available data, nothing you say will make them produce different results.

Re:Reporter who told Missouri officials of website flaw did ... by Dylan16807 on Thursday November 04, 2021 @11:25PM (#29115124)
It's the first result and there aren't very many results. That's not cherry-picking on my end.
Re:Reporter who told Missouri officials of website flaw did ... by brigandish on Thursday November 04, 2021 @01:07AM (#29103796)
I'm not disagreeing, but the advances in medicine between the periods mentioned should be kept in mind. A more precise comparison might be, how many fatalities occurred at the site of the accident, that would remove quite a few other variables. Perhaps those numbers are already showing that but if it is then it's not clear from the quote.
Re:Reporter who told Missouri officials of website flaw did ... by austincheney on Wednesday November 03, 2021 @09:55PM (#29102838)
In the US military as an officer you have a specified amount of time to make the next grade. If you are passed over for promotion too many times career over. Unsurprisingly this gets more challenging the higher you get with only a 2% chance of moving from O6 to O7. There are also educational requirements, both military and civilian, for each grade as well.

So it’s not completely welfare. The benefits offered exist for retention. The military can offer nice benefits because it is the largest employer in the world. It’s like the healthcare and other benefits you get from a corporate employer but much better. The larger the employer the better the benefits tend to get.

Re:Reporter who told Missouri officials of website flaw did ... by csa on Thursday November 04, 2021 @01:22AM (#29103854)
> Unsurprisingly this gets more challenging the higher you get with only a 2% chance of moving from O6 to O7.

This sounds very stark, but it doesn’t tell the whole story.

1. O6 to O7 is colonel to general (or captain to admiral in the navy). Yes, 2% is a heavy cull. Then again, I think everyone involved sort of wants that cull for the top of the military. O7+ are essentially the equivalent of corporate executives. (Edit: just checked the numbers… I believe 2% is the number of generals expected out of a given class of 2lt. Promotion from colonel to general is a much higher percentage).

2. It’s fairly easy, if motivated and not socially, physically, or intellectually limited, to make it 20 years as an officer. Folks typically end up as majors (career-path bound or lower competence) or lieutenant colonels. Colonels tend to be solid all around, even if some of them have a tragic flaw. Folks capped at major usually retire at 20. Folks capped at lt col usually retire at 24-26 years.

3. Promotion from 2lt to 1lt is pretty much automatic around 2-3 years. Ditto 1lt to captain at around 4-6 years total. The first cull is from captain to major, but a big part of that cull is simply folks who don’t want to re-enlist. Most people who stay in plan on staying for 20 to get retirement. Some folks who want to stay in can’t, but this is relativity rare and is typically due to (lack of) need of the military of their skill, general lack of competence, medical issues, or legal issues (dui, etc.). I wouldn’t feel sorry for most of these people except the medical ones.

To get back to the original point, officers don’t quite look like the “welfare” that was being referred to.

That said, some of the jobs that veterans are able to get are absolutely middle class welfare.

Most vets in federal jobs are awesome and are good at what they do. That said, there is a small percentage of vets in federal jobs who are hellbent on being deadweight.

Re:Reporter who told Missouri officials of website flaw did ... by austincheney on Thursday November 04, 2021 @11:13AM (#29108202)
In the reserves it actually is a 2% chance to make O7. A factor less present in the active duty is old age. Vacant slots are harder to find and fill for a variety of factors.
Re:Reporter who told Missouri officials of website flaw did ... by dodobirdlord on Wednesday November 03, 2021 @10:41PM (#29103127)
The upper ranks of officers constitute a very small part of all people in the military, and I doubt they are the subject here.
Re:Reporter who told Missouri officials of website flaw did ... by duxup on Wednesday November 03, 2021 @10:52PM (#29103198)
The schools in my are pay horribly for IT staff, and it shows.

It's not a "welfare" program. Nobody good wants to work there.

Re:Reporter who told Missouri officials of website flaw did ... by hoseja on Thursday November 04, 2021 @03:48AM (#29104423)
That's what welfare is, provide a living to those unable to compete otherwise.
Re:Reporter who told Missouri officials of website flaw did ... by handrous on Thursday November 04, 2021 @11:58AM (#29108776)
But the job does actually need to be done. They're just not paying enough to consistently attract and keep people who can do it well. What can't compete is the pay.

That doesn't make it welfare.

Re:Reporter who told Missouri officials of website flaw did ... by duxup on Thursday November 04, 2021 @07:41AM (#29105829)
So all jobs that pay below market rate are "welfare"?

I don't think that makes sense.

Re:Reporter who told Missouri officials of website flaw did ... by tonypace on Thursday November 04, 2021 @03:47AM (#29104420)
Exactly this. The ratio of equipment to staff is usually very high, the equipment is usually very old, demands are sometimes complex, and pay is governed by a formula developed for white collar workers without better options. The good ones normally leave after one year.
Re:Reporter who told Missouri officials of website flaw did ... by ivalm on Wednesday November 03, 2021 @03:30PM (#29099219)
> hire people that actually care

One thing to note is that hiring skilled IT workers is often outside budget capabilities. It’s not that they want to hire someone incompetent, they simply can’t afford to hire someone competent.

Re:Reporter who told Missouri officials of website flaw did ... by willis936 on Wednesday November 03, 2021 @03:49PM (#29099432)
It doesn't help that they used a Soviet method of denying shortcomings in hopes that fantasy will overrule reality. What can you do when you have limited resources to make your situation worse? Punish people who are helping you for free.
Re:Reporter who told Missouri officials of website flaw did ... by AstroDogCatcher on Wednesday November 03, 2021 @06:55PM (#29101546)
Incompetent people will do anything they can to avoid admitting that they are incompetent.

One of the more interesting possible outcomes of a UBI I hope to see in my lifetime is the ejection of many of the seat-warmers currently occupying IT positions in western public sector organisations.

Re:Reporter who told Missouri officials of website flaw did ... by passerby1 on Wednesday November 03, 2021 @08:14PM (#29102238)
On contrary, it could get worse. The next level after UBI is here, would be an ego satisfaction.

Anyone on a power trip is playing this game with passion, more than a merely seat-warmer.

Re:Reporter who told Missouri officials of website flaw did ... by sirspacey on Wednesday November 03, 2021 @06:36PM (#29101350)
No.

There has been massive interest in modernizing these systems.

It’s the beliefs and attitudes of leadership that cause well intentioned engineers who are willing to take a lower salary to leave

Re:Reporter who told Missouri officials of website flaw did ... by heavyset_go on Wednesday November 03, 2021 @04:38PM (#29099961)
Middle schools can pay administrators $250k+ a year, but can't afford sys admins?
Re:Reporter who told Missouri officials of website flaw did ... by treeman79 on Wednesday November 03, 2021 @04:45PM (#29100031)
My wife (teacher) wasn’t allowed to use the microwave for a year due to the cost of electricity.

They got upset when I suggested we donate 20 dollars to cover microwave budget for entire school for the year.

Re:Reporter who told Missouri officials of website flaw did ... by ranger_danger on Wednesday November 03, 2021 @05:50PM (#29100776)
Something tells me it wasn't really about the cost. Someone just hates smelling food I bet.
Re:Reporter who told Missouri officials of website flaw did ... by treeman79 on Wednesday November 03, 2021 @06:36PM (#29101355)
Microwaves were in classrooms.
Re:Reporter who told Missouri officials of website flaw did ... by passerby1 on Wednesday November 03, 2021 @08:18PM (#29102262)
Is it a power for the sake of power example? Or does the electricity cost heaven there?
Re:Reporter who told Missouri officials of website flaw did ... by treeman79 on Thursday November 04, 2021 @01:20AM (#29103848)
Either a power play or utter incompetence. I’m really not sure.
Re:Reporter who told Missouri officials of website flaw did ... by EvRev on Wednesday November 03, 2021 @10:53PM (#29103206)
Sounds like a good opportunity to teach the kids about solar. The solar ovens were such a memorable experience, but I suppose the cloudy days would be tough. Teaching the kids about DC to AC conversions at the same time as office politics would be a valuable life lesson!
Re:Reporter who told Missouri officials of website flaw did ... by munk-a on Thursday November 04, 2021 @01:06PM (#29109753)
I disagree - it sounds like a good opportunity for the school to either stop pinching pennies so absurdly or for the district to actually start funding education at a reasonable level.
Re:Reporter who told Missouri officials of website flaw did ... by jdavis703 on Wednesday November 03, 2021 @04:54PM (#29100127)
I checked, the top paid IT person in my local Bay Area school district makes $168,000 a year (he’s the CIO). There’s a “L4” software developer making $131,000 a year. The next highest is a DBA earning $129,000 a year. So it would appear at least my district isn’t budgeting a competitive amount for technical talent. These salaries are far below market rate, to the point that many of these people might qualify for subsidized housing.
Re:Reporter who told Missouri officials of website flaw did ... by walrus01 on Wednesday November 03, 2021 @04:57PM (#29100166)
> district makes $168,000 a year (he’s the CIO). There’s a “L4” software developer making $131,000 a year.

I think that really says more about the absolutely absurd cost of living and non-rational real estate costs in the SF bay area than it does about the school district. In many places with normal cost of living, if your US W2 take home is $129k a year, you can live a very comfortable upper middle class lifestyle. Whether or not you have a spouse or partner with their own career and your combined W2 gross income might be $210k a year.

Same as what I said above also applies to absurd real estate and cost of living in Seattle, Vancouver, New York, etc.

Re:Reporter who told Missouri officials of website flaw did ... by jjeaff on Wednesday November 03, 2021 @07:01PM (#29101628)
Sure, and people living in Cambodia would find those salaries excessively high. But I'm not sure what your point is?

Salaries are higher in higher cost of living areas. You have to compare the salary to local living costs to be comparable.

Re:Reporter who told Missouri officials of website flaw did ... by KronisLV on Thursday November 04, 2021 @04:50AM (#29104776)
> You have to compare the salary to local living costs to be comparable.

This is not accurate in a globalized economy, where purchasing power parity (PPP) becomes a bit of a lie. No one is going to ask you if you're from Cambodia or another country, when you'll want to rent a server from AWS, or buy an iPhone, or maybe even a car. Global corporations aren't running charities and are instead concerned with making their products profitable - if anything, they would only use your location to increase the prices of products further if you're capable of buying them, but that's not a widespread practice nowadays for a variety of reasons.

I actually wrote a bit more about it in my blog article, "On finances and savings": https://blog.kronis.dev/articles/on-finances-and-savings which showed how much money i've made over the years while working as a software developer in Latvia (currently around 18'000 euros a year), which means that my ability to make savings is ~5x lower than many of the software developers in the US or other well paid countries - which directly impacts my ability to create a startup and pay for external services/infrastructure, should i so choose.

Of course, on the flip side, one can also talk about how much you're disadvantaging yourself by catering to a clientele of local companies: i generate my company ~20x less profits than an average engineer in Google would for their company.

Re:Reporter who told Missouri officials of website flaw did ... by jjeaff on Sunday November 07, 2021 @10:46PM (#29145964)
By local living costs, I do mean whatever costs are required to live in the area one lives. Whether or not those products or services are the same everywhere or not.

But the fact of the matter is, the costs that make up the largest portion of most people's lives are locally spent.

Re:Reporter who told Missouri officials of website flaw did ... by cat199 on Wednesday November 03, 2021 @08:02PM (#29102157)
True, but tech is not the dominant industry in all areas, and industries needing IT are not strictly limited to tech companies -

blaming education administrators specifically for not having enough funds to pay competitively is drastically different than saying there is a structural problem with the local economy such that only industry X can competitively source IT talent.

in these conversations, comparing tech job X vs other job Y is relevant, because we are talking about 'jobs and wages within local economy as a whole'

Re:Reporter who told Missouri officials of website flaw did ... by skinnymuch on Thursday November 04, 2021 @11:56PM (#29115273)
What about the many costs that stay static? Flights, smart phones, and so much more don’t become a lot cheaper just because of location. Or for flights, Departing location.
Re:Reporter who told Missouri officials of website flaw did ... by tiahura on Wednesday November 03, 2021 @08:08PM (#29102194)
“ In many places with normal cost of living, if your US W2 take home is $129k a year, you can live a very comfortable upper middle class lifestyle. ”

I’m in a very reasonable market. 210 is fine, but nowhere near very comfortable upper middle class.

Re:Reporter who told Missouri officials of website flaw did ... by ivan_gammel on Wednesday November 03, 2021 @05:06PM (#29100266)
Hiring DBA or a developer for a school is extremely inefficient use of the budget. School IT must be standardized and automated to the point where you only need 2 sysadmins and few more first line support people per 50-100 schools to run operations and 4-5 companies developing school management systems for the entire national market, with standardized interoperability.
Re:Reporter who told Missouri officials of website flaw did ... by gamerDude on Wednesday November 03, 2021 @05:25PM (#29100476)
I work with school districts and there are these companies. And they are absolutely atrocious. And they make it difficult to transfer. So schools are somewhat stuck in the old way. Literally every district level person hates the software, but they can't change it.
Re:Reporter who told Missouri officials of website flaw did ... by ivan_gammel on Wednesday November 03, 2021 @05:48PM (#29100746)
This is where government should be able to help with regulation. Nobody should be able to enter or stay on the market without ensuring interoperability, security and accessibility and without transferring certain rights to customers. I’m pretty sure the market will remain attractive for business even with the open source requirement.
Re:Reporter who told Missouri officials of website flaw did ... by munk-a on Thursday November 04, 2021 @01:04PM (#29109728)
America recently had an administration that prided itself on killing two pieces of regulation for each piece it added. There's a strong social issue with even bringing up the R word right now.
Re:Reporter who told Missouri officials of website flaw did ... by thr0wawayf00 on Wednesday November 03, 2021 @05:19PM (#29100403)
That standardization and automation you're talking about costs money too. Schools deal with technical debt on the IT infra level much like SaaS companies do.

Of course, you should be able to cut a $129k/yr DBA if you just spend the millions needed to streamline the IT systems.

Re:Reporter who told Missouri officials of website flaw did ... by ivan_gammel on Wednesday November 03, 2021 @06:02PM (#29100938)
Simple search shows that there are 130 000 schools in the USA. Spending 10M to develop reasonable IT standards and 120M more on compliant software is just $1000 per school. And this is not a military software, it can actually be developed offshore by decent engineers earning half of that DBA salary (that is, you get 2000 _man-years_ of work for those money).
Re:Reporter who told Missouri officials of website flaw did ... by munk-a on Wednesday November 03, 2021 @04:45PM (#29100032)
In the US it looks like middle school administrators make, on average, 57k[1] - which is definitely below a sys admin cost.

1. Edit, source: https://www.zippia.com/school-administrator-jobs/salary/

Re:Reporter who told Missouri officials of website flaw did ... by Iefthandrule on Wednesday November 03, 2021 @04:17PM (#29099733)
You make it sound like no one is responsible for setting the budget and determining that a decently paid IT staff is not worth it.

It is malicious intent the whole way down.

Re:Reporter who told Missouri officials of website flaw did ... by josephg on Wednesday November 03, 2021 @05:58PM (#29100893)
I don’t think it’s malicious intent. Hanlon’s razor: never ascribe to malice what can be explained by incompetence. It’s simply that nobody at any level takes actual responsibility for outcomes. People at the bottom of the system (teachers, parents) can see problems but are usually disempowered and voiceless, and can’t fix them on their own. And people at the top are either ignorant of the real problems or lack real leadership and incentives to fix them. (Or they feel overburdened and overwhelmed).

An old friend of mine teaches the first year CS curriculum at a local university. By all reports he’s phenomenally good at his job. He truly cares and his students adore him. But he’s making a fraction of the salary he could be making in industry. At some point he’s probably going to quit to do a job he’s not as good at, and doesn’t enjoy as much. Why is he paid many times less than he’s worth? Because the university wants to pay CS lecturers who teach 2000 students the same as they pay people who teach poetry to a class of 5. So my friend can’t get a competitive salary without entire departments revolting. Who’s fault is that? I don’t believe it’s malicious intent. It’s just a boring, systematic failure high up in the org chart leading to bland mediocrity. The only people who can do something about it don’t care about outcomes enough to fix the problem.

Re:Reporter who told Missouri officials of website flaw did ... by passerby1 on Wednesday November 03, 2021 @08:24PM (#29102302)
> Because the university wants to pay CS lecturers who teach 2000 students the same as they pay people who teach poetry to a class of 5.

Maybe I'm wrong, but does University gain more profit from a class of 2000 students? If so, could it be the case that your friend does not sell himself at a market price for the teaching position? Probably there's another place which pays more for similar teaching.

There's no blame at all, sometimes people like to sell their time mostly not for money, but for emotions, that's completely understandable.

Re:Reporter who told Missouri officials of website flaw did ... by josephg on Wednesday November 03, 2021 @09:41PM (#29102768)
The university gets paid per student-year. So, yes.

But I can also see an argument that more advanced classes in later years (eg Advanced AI) are at least as valuable for the university compared to earlier subjects. They might have smaller class sizes, but if the subject material is more difficult, it'd be harder to find sufficiently knowledgable teachers. And the availability of classes like that (arguably) sets good schools apart from bad ones.

Its certainly a difficult problem. But it sounds like they aren't solving it well, and I think they're slowly driving out one of their best teachers.

Re:Reporter who told Missouri officials of website flaw did ... by Iefthandrule on Wednesday November 03, 2021 @07:28PM (#29101876)
> The only people who can do something about it don’t care about outcomes enough to fix the problem.

In other words, malicious intent the whole way down. Though I'm sure it feels good to blame the faceless "bureaucracy" and leave it at that...that way no one has to take responsibility.

Re:Reporter who told Missouri officials of website flaw did ... by josephg on Wednesday November 03, 2021 @09:36PM (#29102748)
No, it doesn't feel good to blame a faceless bureaucracy. It makes me feel kind of powerless and awful. But I still think that description is more accurate.

Its possible we're using different definitions though. Malicious intent sounds to me like "I am glad you are underpaid because I enjoy your misery". Or "You might be suffering but I don't care." I can count on one hand the number of people I've heard about in the workplace who are like that.

On the other hand, go talk to people near the top of any medium-to-large org chart. You'll find a mountain of people who feel like they're overwhelmed by the minutia of the company's day to day concerns, and they don't have time to do strategic leadership. That they aren't meeting the demands their role is placing on them. Or they're failing the people below them in the org chart due to their own vague mediocrity.

I don't think hating people in this position helps. Your scorn isn't going to magically make them better at their jobs. I see it as a symptom of our crappy organisation structures failing at larger sizes. We habitually centralize power into the hands of a few people. And then the people at the top of the org chart are overwhelmed by choice and indecision. And the people at the bottom are knowledgable but powerless, and are structurally forbidden from solving their own problems. (Or, sadly, people develop a learned helplessness about solving problems in the organisation at all.)

Re:Reporter who told Missouri officials of website flaw did ... by jedberg on Wednesday November 03, 2021 @04:29PM (#29099856)
Is it worth it though? If a few teachers have their identity stolen, will that in any way hurt the school? I mean, it should hurt them, but it's unlikely that it will. The only people who might feel bad are the moral IT folk who created the problem.
Re:Reporter who told Missouri officials of website flaw did ... by jjeaff on Wednesday November 03, 2021 @06:37PM (#29101358)
I mean, is there really any risk of that anymore? Equifax had already seen to it that basically every adult in America's personal information is out there.
Re:Reporter who told Missouri officials of website flaw did ... by gameswithgo on Wednesday November 03, 2021 @06:52PM (#29101524)
americans don’t want to pay taxes, then americans complain about the quality of their infrastructure
Re:Reporter who told Missouri officials of website flaw did ... by Iefthandrule on Wednesday November 03, 2021 @07:29PM (#29101879)
It's more about Americans not wanting to hold their elected officials accountable.
Re:Reporter who told Missouri officials of website flaw did ... by nend on Wednesday November 03, 2021 @03:56PM (#29099510)
>It'd be better for society to fire clowns like these and administer them unemployment than to have them crowd out those that actually give a shit.

The people that give a shit are making 10x as much by not working for a public middle school.

Fire the current lot if you want, but they'll just be replaced by the next set of people who aren't skilled enough to make market rate.

Re:Reporter who told Missouri officials of website flaw did ... by ethbr0 on Wednesday November 03, 2021 @04:32PM (#29099892)
Exactly.

Most non-core-business organizations can't afford to hire someone competent, and therefore hire someone else.

But obviously that person isn't going to say "Gee, I'm really not great at this computer stuff, but I'll do what I can." They say "Sure, I know all about all the computer stuff!"

And then you have their leadership (who doesn't know any details), taking whatever they report up at face value.

The governor probably believed he had a leg to stand on here, because I'm sure that's exactly what his people told him.

Re:Reporter who told Missouri officials of website flaw did ... by handrous on Wednesday November 03, 2021 @04:41PM (#29099985)
> The governor probably believed he had a leg to stand on here, because I'm sure that's exactly what his people told him.

My money's on this being purely a political decision. And for that, considering who it is and their position in the political landscape, I think it's too early to definitively call it a blunder.

Re:Reporter who told Missouri officials of website flaw did ... by munk-a on Wednesday November 03, 2021 @04:48PM (#29100073)
I think it's a pretty terrible political decision regardless of the outcome. Whenever you take a stance on a highly technical issue like this you're rolling the dice and hoping that you don't actually have a number of technical minded folks in your state. It can backfire amazingly.

It's much easier to play political games on much more abstract issues where it's harder to evaluate the options.

Re:Reporter who told Missouri officials of website flaw did ... by handrous on Wednesday November 03, 2021 @04:51PM (#29100099)
I don't think many tech folks, even in Missouri, are among this guy's voters, and the ones who are, aren't turning "blue" over this (they're probably in it for religious reasons, i.e. abortion).

Meanwhile, he's received national attention.

We'll see, but it may yet be a smart play, politically speaking. I'm not saying it for-sure is, I just don't think that result's anywhere near being off the table.

Re:Reporter who told Missouri officials of website flaw did ... by munk-a on Wednesday November 03, 2021 @05:46PM (#29100724)
I fled to Canada over a decade ago so take my opinion here with a grain of salt but... I think that folks still talk to other folks on a local and familial level so a cousin of mine that's anti-vax has reached out to talk about technical news occasionally and you'll tend to chat with neighbors.

So having someone technically minded in your general blob of associations is generally enough for these sorts of obviously stupid moves to get politicians in serious trouble.

The stakes are a lot lower obviously - but this is a much clearer case of technical malpractice than anything having to do with Snowden and reminds me of Morris[1]'s case - basically it's complete BS and a misuse of the law.

1. https://en.wikipedia.org/wiki/Robert_Tappan_Morris (I might be thinking of someone else - I thought there was a teenager that got the book thrown at them back in the early days of the web but maybe I'm just misremebering things)

Re:Reporter who told Missouri officials of website flaw did ... by gibspaulding on Wednesday November 03, 2021 @11:06PM (#29103274)
>I fled to Canada over a decade ago

Have you written about this anywhere? I'd love to hear more about the motivation (not that it's hard to guess possibilities) and what the process actually looked like. I hear people threatening to move to Canada all the time, but there don't seem to be too many who go through with it!

Re:Reporter who told Missouri officials of website flaw did ... by munk-a on Thursday November 04, 2021 @01:00PM (#29109659)
Oh - I met a partner in Canada and when we looked at the costs to immigrate one way or the other it made a lot more sense to move up to Canada. Additionally the service offering was quite attractive up here, I'm in BC so there isn't any free pharmacare but there still is a pretty large provincial subsidy program.

Additionally I was pleasantly surprised, when I moved up, to learn that Canada doesn't have the same culture of greed. I feel like, if you aren't making every cent possible in America that you could - if you aren't constantly extracting the absolute maximum revenue - you're looked down on. Up here I've found a much nicer focus on balancing work with interests.

Re:Reporter who told Missouri officials of website flaw did ... by ummonk on Wednesday November 03, 2021 @07:43PM (#29101989)
Ehh I dunno. Hiring a top engineer for 500k would go a lot further than hiring 10 mediocre engineers for 50k apiece.

The bigger problem is the risk of corruption when you start hiring 500k engineers.

Re:Reporter who told Missouri officials of website flaw did ... by bruce511 on Thursday November 04, 2021 @12:42AM (#29103725)
Having a dept of 1 engineer is not great [1]. You'd want ideally 3 or 4. Whick is kinda no-man's-land between 50k and 500k. Say 125k,which would get you good, but not stellar. (and would be an improvement over 10 somewhat incompetent.)

[1] having just 1 creates lots of bigger issues ;

Availability (what happens when he's sick or on vacation).

Technical documentation (there is none, its all in his head).

Role transfer (when he leaves there is short intense handover, then nothing).

Opinioned design - he does it his way, no discussion necessary - some will be good, but some will be bad.

When he leaves, you can't replace him. 500k engineers won't work for a place where you just maintain the system the last guy designed and wrote - they want to design and write their own stuff from scratch.

I could go on, but programming depts of 1 are usually a bad idea...

Re:Reporter who told Missouri officials of website flaw did ... by bavila on Wednesday November 03, 2021 @11:47PM (#29103510)
> Hiring a top engineer for 500k would go a lot further than hiring 10 mediocre engineers for 50k apiece.

That sounds reasonable, unless you're an elected government official in a state where salaries of government employees are public information. Local media outlets and your political opponents will have a field day over a government employee making a half-a-million dollar salary.

The public won't ever be able to understand or accept why one talented person should be made so wealthy in relation to the value they provide. However, the public will be fine with the same amount of money being spread out across 10 employees, since it still keeps all recipients in the poor house together with everyone else.

Re:Reporter who told Missouri officials of website flaw did ... by perl4ever on Wednesday November 03, 2021 @10:29PM (#29103057)
A regional bank headquartered in my area of upstate NY, which is also a publicly traded company, paid, in 2019, three out of their five C-level executives whose salary is disclosed, a base salary of $500K or less.

Do you or have you worked in a place where "engineers" make $500K? Have you thought about what they outsource to people making 1/10th or less, and why?

Re:Reporter who told Missouri officials of website flaw did ... by ethbr0 on Wednesday November 03, 2021 @08:48PM (#29102458)
The bigger problem is when their manager, and their manager, makes <500k. The manager-should-make-more rule gets squirrelly for technical stuff.
Re:Reporter who told Missouri officials of website flaw did ... by handrous on Wednesday November 03, 2021 @04:39PM (#29099970)
My spouse is a teacher and has practically made a game of "which low-status jobs would match my current benefits-inclusive income, while never making me take work home or making me deal with kids' mental health issues, which is incredibly stressful?" With current wage hikes in the service industry, the proportion that make the cut is going up daily.
Re:Reporter who told Missouri officials of website flaw did ... by RHSeeger on Wednesday November 03, 2021 @06:12PM (#29101068)
I think it varies wildly by area, too. The teachers in my area appear to make a reasonable salary once you include pension. Admittedly, the stress level of the job comes into play, too...
Re:Reporter who told Missouri officials of website flaw did ... by CoastalCoder on Wednesday November 03, 2021 @04:59PM (#29100184)
> The US needs to stop using public facilities (schools, the military, etc) as white-collar welfare and hire more people that actually care.

In my experience, most IT/CS people who seek to work for state/federal government do care.

Unfortunately the combination of extreme red tape, low pay, inability to fire lazy employees, and occasionally being punching bags for politicians trying to score cheap points with their constituents, take their toll over time.

Re:Reporter who told Missouri officials of website flaw did ... by thr0wawayf00 on Wednesday November 03, 2021 @05:08PM (#29100283)
So much this. Pay and working conditions are such a joke for so many government jobs compared to the private sector. Government workers make nothing compared to the private sector, we expect them to be miracle workers, we refuse to acknowledge them when they do work miracles, and then we get mad and want to slash the budget when they can't.

It really sucks because I'd happily work for slightly under market rate to do work for a government office, but I just can't work for 1/3-1/2 of the pay I make working in the private sector, not with housing prices the way they are.

Re:Reporter who told Missouri officials of website flaw did ... by pirate787 on Wednesday November 03, 2021 @05:16PM (#29100379)
Federal govt IT is basically competitive on salary but the hiring process is rigged. The job descriptions are tightly bound to specific experience that only other govt workers or contractors could know and understand.
Re:Reporter who told Missouri officials of website flaw did ... by d3ad1ysp0rk on Wednesday November 03, 2021 @06:15PM (#29101106)
Where can I make 150-200k/year in federal IT?
Re:Reporter who told Missouri officials of website flaw did ... by alexjplant on Wednesday November 03, 2021 @06:25PM (#29101227)
Last I checked $140k is about the going rate for government contractor software engineering work in the DC/Northern Virginia area. Add $10-20k for a Secret clearance or Public Trust and $30-50k for a Top Secret clearance (though you'll probably have to deal with working in a SCIF at least some of the time with a clearance). I'm pretty sure you can push that latter number even higher if you get a TS/SCI and start doing spooky stuff.
Re:Reporter who told Missouri officials of website flaw did ... by themitigating on Wednesday November 03, 2021 @08:29PM (#29102344)
But that's not w2
Re:Reporter who told Missouri officials of website flaw did ... by alexjplant on Wednesday November 03, 2021 @08:59PM (#29102538)
It was two years ago (and according to my friends in the industry it still is).
Re:Reporter who told Missouri officials of website flaw did ... by dghlsakjg on Thursday November 04, 2021 @12:33AM (#29103698)
Working on a w2 for a private company that contracts with the government is a world of difference from working on a w2 for the government.
Re:Reporter who told Missouri officials of website flaw did ... by 3np on Thursday November 04, 2021 @07:03AM (#29105571)
What’s w2?
Re:Reporter who told Missouri officials of website flaw did ... by Sohcahtoa82 on Thursday November 04, 2021 @02:34PM (#29110889)
"w2" refers to tax form W-2 [0], which is a form given to direct hire employees during tax filing season.

It contrasts to form 1099 [1] which are given to independent contractors.

[0] https://www.irs.gov/forms-pubs/about-form-w-2

[1] https://www.irs.gov/forms-pubs/about-form-1099-misc

Re:Reporter who told Missouri officials of website flaw did ... by hn_throwaway_99 on Wednesday November 03, 2021 @04:06PM (#29099626)
> unencrypted the source code from the webpage

Because "reading HTML" is now "unencrypting".

People got caught with their pants down and are now just trying to lie their way out of it, nothing new but still sad.

Re:Reporter who told Missouri officials of website flaw did ... by Eldt on Wednesday November 03, 2021 @04:13PM (#29099685)
The SSNs were base64 encoded I believe, which is strange to consider encryption, but they also seem to be conflating the "decryption" of that with viewing the source code. This is just so ridiculous of them.
Re:Reporter who told Missouri officials of website flaw did ... by tyingq on Wednesday November 03, 2021 @05:27PM (#29100494)
They were. It was the _VIEWSTATE thing that ASP.NET sticks into pages. The developers put the full SSN into the _VIEWSTATE object, which is base64 encoded into the pages.

See https://news.ycombinator.com/item?id=28992667

There's a good comment there that the Microsoft ASP.NET help pages specifically call out an SSN as a terrible thing to put into _VIEWSTATE :)

Re:Reporter who told Missouri officials of website flaw did ... by jdavis703 on Wednesday November 03, 2021 @04:58PM (#29100177)
Encoding is not encryption. That’s like if I got the raw bytes of Unicode characters and converted them to legible text. Or another way, that’s like two people talking about me in a language I don’t understand, and then I respond to them in said language.
Re:Reporter who told Missouri officials of website flaw did ... by matt123456789 on Wednesday November 03, 2021 @05:22PM (#29100442)
That’s a terrific analogy. And it’s one that a jury will relate to. Sadly, if it goes to court, the poor guy’s lawyer is gonna have to spend a lot of time explaining how the State’s servers were sending this information in clear text to everyone who requested the page, refuting the false equivalence that the prosecution will make between “hacking” and “view source->decode to ASCII”.
Re:Reporter who told Missouri officials of website flaw did ... by wizzwizz4 on Wednesday November 03, 2021 @09:27PM (#29102693)
It wasn't encrypted. It was written using Base64 – the computer equivalent of the phonetic alphabet. Anyone can “decode” it by hand, like Morse code, and the practised can read it off directly.

This Base64 was placed inside an HTML document. That's a bit like a Word document, except the formatting (bold, underline, big, small, Comic Sans) is written next to the text, so the computer knows how to display it. HTML is designed to be human-readable; in fact, it's designed for humans to write directly, using a text editor.

Here's an example of an HTML document, and here's a Base64 decoding table. (There's also a printout from Wikipedia, if you want to know how people can do it in their heads.) The jury should be able to read this SSN off, with no prior experience, in about ten minutes.

This was sent, by the State's computers, to every user of the system, due to a programming error.

  <!DOCTYPE html>
  <html>
    <head>
      <title>My Webpage</title>
    </head>
    <body>
      <h1>This is an HTML document</h1>
      <p>
        It might not look like much, but it's a website!
        This is what they look like to computers, and
        web developers. There is usually other code behind
        the scenes, where sensitive data should be stored,
        but this is the public part.
      </p>
      <!-- Internal state (public component).
           Should not contain sensitive data! -->
      <input type="hidden"
             name="__VIEWSTATE"
             id="__VIEWSTATE"
             value="dDwxMjM7dDxwPGw8
                    U1NOOz47bDw5MTIt
                    MzgtNjU0Nzs+Pjs7
                    Pg==">
    </body>
  </html>
Re:Reporter who told Missouri officials of website flaw did ... by extra88 on Wednesday November 03, 2021 @04:44PM (#29100025)
There's no mention of any kind of encoding in the delivered HTML. From the newspaper [0]:

> the newspaper found that teachers’ Social Security numbers were contained in the HTML source code of the pages involved.

and later:

> In reality, the Post-Dispatch discovered the vulnerability and confirmed that the nine-digit numbers were indeed Social Security numbers.

[0] https://www.stltoday.com/news/local/education/missouri-teach...

Re:Reporter who told Missouri officials of website flaw did ... by tyingq on Wednesday November 03, 2021 @05:28PM (#29100507)
Re:Reporter who told Missouri officials of website flaw did ... by extra88 on Wednesday November 03, 2021 @05:46PM (#29100729)
Thanks.

Given this, I think the journalist over-simplified the situation in their story and that the "F12" jokes are unjustified. Recognizing there's a disclosure of private information here requires a lot more technical knowledge beyond the ability to view the HTML source.

The governor is still wrong for pursuing this and what the newspaper did was right, given that they disclosed it to the responsible parties and didn't publish until the problem site was taken down.

Re:Reporter who told Missouri officials of website flaw did ... by tyingq on Wednesday November 03, 2021 @05:48PM (#29100747)
I feel like the F12 jokes are fine, since they don't even match the Governor's exaggerated rhetoric about "hacking". Pasting the base64 into one of many online decoders isn't much of an extra step. The Governor kept calling it a complicated 8 step process or something similar to that.
Re:Reporter who told Missouri officials of website flaw did ... by rrobukef on Wednesday November 03, 2021 @06:30PM (#29101283)
Base64 can be done by hand with two tables: one splitting every character in three times two bits and one that takes four pairs of bits and looks it up in the ascii table. Done.

It's hard to call this encryption.

Re:Reporter who told Missouri officials of website flaw did ... by wizzwizz4 on Wednesday November 03, 2021 @10:03PM (#29102887)
It can also be done using a few small books, mapping strings of 4 base 64 characters into 3 ASCII characters. With 100 printable characters (according to Python), and assuming you can get 96 per page (4 columns of 24; possible with clever layout), that would fill about 50 books.

Okay, maybe that's not very efficient.

Each pair of Base 64 characters contains a single ASCII character, plus some change. That would take three lookup tables of about 1000 entries each; given that the “change” letters could use character ranges, that would take 3 or 4 sheets of A4 (or A3, if you wanted large print).

Re:Reporter who told Missouri officials of website flaw did ... by Sohcahtoa82 on Thursday November 04, 2021 @03:26PM (#29111487)
I've always imagined that somewhere out there is a dude who has spent time to teach himself how to decode/encode base64 in his head.

Best I've done so far is to recognize that "eyJ" means I'm probably looking at JSON, since `{"` followed by any letter will always begin with that.

Re:Reporter who told Missouri officials of website flaw did ... by dotancohen on Thursday November 04, 2021 @05:01AM (#29104825)

  > It's hard to call this encryption.
It's a lie to call this encryption. It is encoding, not encryption.
Re:Reporter who told Missouri officials of website flaw did ... by jlgaddis on Wednesday November 03, 2021 @05:19PM (#29100414)
You must not be aware that CTRL-U is the secret h4x0r backdoor key for "unencrypt".
Re:Reporter who told Missouri officials of website flaw did ... by xxpor on Wednesday November 03, 2021 @04:10PM (#29099662)
Someone probably tried to explain how TLS works and it flew right over their heads.
Re:Reporter who told Missouri officials of website flaw did ... by harikb on Wednesday November 03, 2021 @04:05PM (#29099614)
Part of this is general attitude towards all hacking - that systems can “never be secured”, it is never the designer/implementer’s fault, and we should just blame the bad actors.

When banks/financial systems can get away with not upgrading a decade old Java framework with 6 month old struts vulnerability, and just blame the hacker, it is not surprising the average school sysadmin will do the same.

Re:Reporter who told Missouri officials of website flaw did ... by kodah on Wednesday November 03, 2021 @03:54PM (#29099488)
The military and education do hire people that care, insinuating that they don't seems very wrong. What I do see here, is that someone is speaking far outside their domain of expertise. Software Engineers love to do this on a lot of subjects. Having a deep background in Systems it's amusing at times, but I certainly wouldn't say they don't care.
Re:Reporter who told Missouri officials of website flaw did ... by alexjplant on Wednesday November 03, 2021 @04:02PM (#29099583)
> insinuating that they don't seems very wrong

It's a good thing that's not what I did then... I said that the bad workers "crowd out those that actually give a shit", which means that there _are_ indeed people that care (albeit fewer than there should be).

> What I do see here, is that someone is speaking far outside their domain of expertise.

I spent 15 years working in government contracting, specifically in defense. I've worked with a _lot_ of civilian DoD employees (many of whom I respect immensely on a professional basis and consider my friends). I also am related to and am friends with a number of former public school teachers that left their field for greener pastures. Institutional rot isn't exactly a secret.

Per the HN guidelines please

> Assume good faith.

Re:Reporter who told Missouri officials of website flaw did ... by kodah on Wednesday November 03, 2021 @04:51PM (#29100094)
Yeah, your corrected statement still seems wrong. I disagreed with your assessment, I didn't "assume bad faith".

My personal disagreement is blaming individual people. There should be funding and education resources set up to ensure that people who make calls like this are educated enough to do so. You're in the business of personal accountability and I'm in the business of saying the people are a byproduct of the failing system. I'll bet my next paycheck if you wash out everyone that you deem lackluster and replace them with people you find to be excellent, the same outcome will be had over a matter of time.

Re:Reporter who told Missouri officials of website flaw did ... by torstenvl on Wednesday November 03, 2021 @04:23PM (#29099796)
The military does hire people who care, and we are constantly frustrated re people who don't care.
Re:Reporter who told Missouri officials of website flaw did ... by mixmastamyk on Wednesday November 03, 2021 @03:50PM (#29099454)
We need laws not just to protect whistleblowers (etc.) but to punish those who retaliate against them.
Re:Reporter who told Missouri officials of website flaw did ... by the_optimist on Wednesday November 03, 2021 @04:08PM (#29099634)
And just like that, everyone is a “whistleblower”. And I saw that as someone with a very strong interest in disclosure and transparency.
Re:Reporter who told Missouri officials of website flaw did ... by mixmastamyk on Wednesday November 03, 2021 @06:02PM (#29100929)
Shorthand, why I put (etc.) in there. I could list a lot of things like "security researcher" and here, "journalist." Good enough?
Re:Reporter who told Missouri officials of website flaw did ... by throwaway2037 on Thursday November 04, 2021 @03:22AM (#29104303)
This exists in the UK for the finance industry.
Re:Reporter who told Missouri officials of website flaw did ... by butterfi on Wednesday November 03, 2021 @05:41PM (#29100684)
Back in the 80's, my computer teacher kicked me out of class because I had logged into my friends account at another school and downloaded instructions for an "assassination game" (pick a name from a hat, 'assassinate' your victim with a toy gun) which we never played because we just weren't that interested. The teacher was going through the trash and "discovered" my "hacking" because everything was printed on paper. Fortunately for me, I had access to other computers and went on to a long, successful career in computers. No thanks to you, shitty computer teacher.
Re:Reporter who told Missouri officials of website flaw did ... by chucksta on Wednesday November 03, 2021 @03:58PM (#29099528)
Similar experience, their reasoning why it was so stern was because the password acquired was valid throughout the entire district, and used for multiple core systems (security, AD, grades, etc..)

No one thought to ask IT why they used the same PW 5+ times for critical infra, its all just the kids fault for finding one of them

Re:Reporter who told Missouri officials of website flaw did ... by RNCTX on Wednesday November 03, 2021 @10:21PM (#29103010)
> The US needs to stop using public facilities (schools, the military, etc) as white-collar welfare and hire more people that actually care. Ignorance is forgivable but when combined with a steadfast opposition to personal growth it becomes malicious. It'd be better for society to fire clowns like these and administer them unemployment than to have them crowd out those that actually give a shit.

That presumes that the purpose of school is perceived by the participants to be something other than printing credentials that justify trans-generational wealth and power accrual.

Re:Reporter who told Missouri officials of website flaw did ... by seattle_spring on Wednesday November 03, 2021 @08:51PM (#29102486)
> I responsibly disclosed a method of bypassing their web content filter

If you don't mind me asking... why on Earth did you do this? My goal as a teenager was to find ways to get around content filters in middle school for fun, not so I could tell the teacher about them.

> It'd be better for society to fire clowns like these and administer them unemployment than to have them crowd out those that actually give a shit.

Administrators that "gave a shit" would be fighting to remove overzealous content filters, not reinforce them.

Re:Reporter who told Missouri officials of website flaw did ... by causi on Thursday November 04, 2021 @01:08AM (#29103806)
I was accused of hacking when I used the "netsend" DOS command to send the letter "Q" one time to the other computers in the lab.